DMARC Record Validator

Checking a domain's DMARC record is instant:

Enter a domain. Type any domain name (e.g., gmail.com, yourdomain.com) into the input field. You don't need to include _dmarc. — the tool prepends it automatically.

Click Validate. The tool queries Cloudflare's DNS over HTTPS API for the _dmarc.yourdomain.com TXT record. Results appear in under a second.

Review the analysis. Each DMARC tag is displayed with its raw value, a plain-English explanation, and a status indicator (valid, warning, or error). Common issues like missing rua reporting addresses or overly permissive p=none policies are flagged with actionable recommendations.

Key features:

• Live DNS lookup — real queries, not cached data
• Full tag parsing — v, p, sp, rua, ruf, pct, adkim, aspf, fo, rf, ri
• Validation warnings — detects missing tags, invalid values, and weak policies
• No API key needed — runs entirely client-side via Cloudflare DoH

A DMARC record is a DNS TXT record with semicolon-separated tags. Here's what each one means:

• v=DMARC1 — Version identifier. Must be the first tag and must equal DMARC1.
• p= — Policy for the domain. Values: none (monitor only), quarantine (mark as spam), reject (block entirely). reject is the strongest protection.
• sp= — Subdomain policy. Same values as p. If absent, subdomains inherit the domain policy.
• rua= — Aggregate report recipients. Comma-separated mailto: addresses that receive daily XML reports.
• ruf= — Forensic report recipients. Individual failure reports (less commonly used due to privacy concerns).
• pct= — Percentage of messages subject to the policy (1–100). Default is 100. Useful during rollout.
• adkim= — DKIM alignment mode. r (relaxed, default) or s (strict).
• aspf= — SPF alignment mode. r (relaxed, default) or s (strict).
• fo= — Failure reporting options. Controls when forensic reports are generated.
• ri= — Reporting interval in seconds (default 86400 = 24 hours).

Follow these recommendations for maximum email security:

• Start with p=none — Deploy DMARC in monitor mode first. Add rua addresses to collect aggregate reports and analyze which services send email on your behalf.
• Progress to quarantine, then reject — Once you've confirmed all legitimate senders pass SPF/DKIM alignment, tighten the policy progressively.
• Always include rua — Without aggregate reporting, you're flying blind. Use a DMARC report analyzer to process the XML data.
• Set pct=100 — A percentage below 100 means a portion of failing emails will bypass your policy. Only use lower values during initial rollout.
• Don't forget subdomains — Set sp=reject to prevent attackers from spoofing subdomains you don't use for email.
• Pair with SPF and DKIM — DMARC relies on SPF and DKIM alignment. Ensure both are correctly configured before enforcing a DMARC policy.